One Prompt Exposed Every Agent in Its Region Under AWS's Old AgentCore Default

1The Default Role Covered Every Agent in the Account's Region

Companies can deploy their AI agents on Amazon Bedrock AgentCore, a managed AWS platform. On October 8, 2026, the security firm Zenity Labs showed that one prompt to a single AgentCore agent could expose all the others. The attacker used a prompt injectionGlossaryPrompt InjectionPrompt injection is an attack in which adversarial input manipulates an AI agent into performing unintended actions. The attacker embeds instructions… to make an agent with a web-request tool call the instance metadata service. This local AWS endpoint hands out the temporary credentials of the agent's cloud role. By default, that role was not limited to its own agent. It held permissions over every AgentCore agent in the same account and region. Least privilegeGlossaryLeast PrivilegeThe principle of least privilege requires that every identity (human or machine) operates with only the minimum permissions necessary to complete its… exists to close exactly that gap.

The default AgentCore role wasn't scoped to the specific agent. Instead, it included broad permissions across all AgentCore resources in the entire AWS account's region.

Tamir Ishay Sharbat and Lana Salameh, Zenity Labs

With those credentials, the researchers listed every agent in the region. They could read private conversations across agents, users and sessions and send requests to any agent, including internal ones. Zenity Labs says an attacker needed only chat access to one exposed agent. AWS says an agent can access another AWS account only if the developer grants permissions on both sides. Inside AWS, the blast radiusGlossaryBlast RadiusBlast radius is the total extent of damage that can result from a security incident, measured by the systems, data, and operations that could be… therefore stayed within one account and region. Stolen credentials have carried an agent further before. In the JadePuffer attackNewsAn AI Agent Ran a Ransomware Attack on Its OwnJadePuffer is what the security firm Sysdig calls the first ransomware attack run start to finish by an AI agent, with no human directing it. The… reported in July, an agent used them to move through a network on its own.

2The Credential Store Was Readable by the Agent It Was Kept From

AgentCore recommends keeping an agent's credentials for MCP serversGlossaryMCP ServerAn MCP server is a program that exposes capabilities to AI agents over the Model Context Protocol. It publishes MCP tools the agent can invoke, MCP…, connectors and APIs away from the agent itself. They go into AgentCore Identity and AWS Secrets Manager. AgentCore Gateway then adds them to the requests that pass through it. The default role held permission to read those secrets in Secrets Manager. In a follow-up post, the researchers used them to access services outside AWS. A gateway that holds credentials for an agent protects them only while the agent's cloud role cannot read the store that holds them.

The behavior described is documented and expected. AgentCore agents can access the credentials for their own execution role through the metadata service.

AWS, statement published by Zenity Labs

Zenity Labs reported the findings to AWS in December 2025 and January 2026. AWS told the researchers that newly deployed agents have used only the newer version of the metadata service, IMDSv2, since February 14, 2026. On September 29, 2026, the researchers found that AWS had removed the default role's region-wide permissions to run agents, read conversations and access Secrets Manager. Zenity Labs says all the issues it describes have been patched, although AWS calls the behavior documented and expected. Its post does not say whether agents deployed before these changes were updated. AWS recommends execution roles that hold only what their agents need.

Source: Tamir Ishay Sharbat and Lana Salameh, Zenity Labs, AgentCorruption: How A Single Prompt Collapsed The Entire Cloud Security ModelExternal Link Tohttps://labs.zenity.io/post/agentcorruption-how-a-single-prompt-collapsed-the-entire-cloud-security-model, October 8, 2026.